Why your CRM Might Be Your Biggest Compliance Risk: Lessons from a Recent Audit

In will‑writing and estate‑planning businesses, we often talk about AML, CDD, and file management as the headline risks. But there is a quieter, more operational risk that can be just as damaging - sitting right inside your CRM.

I’ve just completed a CRM audit for an estate planning business. Amongst other things, I wanted to understand how effective the system was at chasing clients and preventing instructions from falling through the cracks.

The answer matters more than most firms realise. When a client doesn’t complete their instructions — or when signed documents never come back — the risk isn’t just operational. It’s legal, financial, and reputational. And it's yours.

The Hidden Risk: Uncompleted Instructions and Unsigned Documents

Two scenarios create the biggest exposure for will writers and estate planners inside their firms:

1. Instructions that never complete

The client gives initial instructions, perhaps even pays a fee, but then goes quiet. They needed to give some thought to how much to give to the grandchildren, or who to appoint as executor or guardian - and they never come back to you to confirm. Drafts sit waiting for approval. Reminders are inconsistent. You can't finalise the documents and issue them, let alone arrange for signing to take place.

Risk:   If the client dies before the documents are finalised, the firm may face a disappointed beneficiary claim - especially if the delay can be traced back to poor follow‑up or inadequate workflow controls. As a will writer and estate planner, you owe a duty of care not just to your client, but to the intended beneficiaries. If negligence means a beneficiary loses out on 'what they should have won' they can sue the will writer directly, and the value of their claim is essentially the loss that they have suffered. What would they have received if the will was drafted or executed correctly?

2. Documents issued but never signed and returned

The will or LPA is drafted, issued, and then… nothing. Weeks pass. No signature. No return. No escalation. No confirmation that the client has signed the documents, and no evidence that they have done so correctly to give effect to the intended planning.

Risk:   The firm may be criticised for failing to ensure the client understood the importance of signing promptly, or for not having a robust process to track outstanding documents. Again, if a client passes away before signing the documents and a beneficiary loses out, your firm could face a disappointed beneficiary claim.

In both cases, the root cause is often the same: your CRM is not being used to effectively manage risk inside your business.

Why This Matters: Compliance, PI Risk, and Client Protection

A CRM is not just an operational tool. In this sector, it is a risk‑management system.

A well‑configured CRM should, and can, protect the firm by ensuring:

• No instruction is left dormant

• No issued document is forgotten

• Every client is chased consistently

• Every reminder is logged

• Every delay is evidenced

• Every risk is escalated

• Every file has a clear audit trail

  
  

When these controls are missing, the firm is exposed to:

• Disappointed beneficiary claims

• Negligence allegations

• Insurer scrutiny

• Criticism from professional bodies

• Reputational damage

  
  

And all because the CRM wasn’t doing the job it should.

The Outcome of the Audit

For the client I worked with, the audit resulted in:

• A redesigned workflow

• Automated reminders for clients and teams at every risk point

• A dashboard showing all “at risk” files and the number sitting at each stage of the workflow

• A new escalation pathway

• An audit trail

• Staff training on consistent usage

  
  

The firm now has full visibility of every instruction, every document, and every outstanding action. More importantly, they have reduced their exposure to one of the most common - and preventable - PI risks in the sector.

If You’re Not Confident in Your CRM, You Should Be Concerned

Most firms assume their CRM is 'doing the job.' But unless it is actively preventing stalled instructions and unsigned documents, it's a risk.

A CRM audit is one of the simplest, fastest ways to strengthen your compliance and protect your firm.

Need Help Reviewing Your CRM?

WillComply offers independent CRM audits specifically for will writing and estate planning businesses. We can assess your workflows, reminders, risk controls, and audit trails - and give you a clear, practical plan to reduce your exposure.

If you’d like to discuss a CRM audit for your firm, get in touch today:

Contact